It is also capable of monitoring keystrokes, uploading files to and downloading files from a remote machine, webcam surveillance, and more.Īccording to the ad, it can also present a custom native window requesting users to enter information such as a credit card number, and can access the victim’s iCloud account – even if it’s protected with 2-factor authentication. The Proton RAT allows the attacker to connect remotely to the infected machine. Proton is a Remote Access Trojan (RAT) for macOS, and was spotted being sold on underground Russian cybercrime forums earlier this year.įor 40 Bitcoins, the buyers would get unlimited installations, and the malware was signed with a legitimate Apple developer signature, so it doesn’t get blocked by Apple’s Gatekeeper technology. (You can find the Activity Monitor in /Applications/Utilities).
“If you see a process called ‘Activity_agent’ in the OSX Activity Monitor application, you are infected,” the developers noted. The primary download mirror and website have not been compromised. Only users who have downloaded the HandBrake-1.0.7.dmg file from the download mirror at are in danger. “Anyone who has downloaded HandBrake on Mac between and needs to verify the SHA1 / 256 sum of the file before running it,” the developers warned on Saturday, and prominently displayed a link to the alert on the project’s main page. dmg file switched with a Trojanized version containing the Proton RAT. A mirror download server of HandBrake, a popular open source video conversion app for Mac, has been compromised, and the legitimate app.
0 kommentar(er)
